News Roundup

Apache Iggy 0.9.0 moves VSR clustering into the project’s standard server and becomes its first release as an Apache Top-Level Project. The release also adds per-topic durability policies, a native PHP SDK, new connectors and broad SDK updates. Existing deployments need to account for incompatible 0.8.x data directories, wire-protocol changes and revised server configuration.

Three Drupal AI projects have released updates affecting Gemini embeddings, Mautic integration and natural-language Views configuration. The changes range from new embedding models and permission-aware Mautic tools to fixes for failed or invalid Views operations. Drupal teams should review model configuration, upgrade requirements and release maturity before adopting the changes.

ChatGPT Ads 1.0.1 fixes how its server-side Conversions API handles personal identifiers when the module's consent gate is enabled. Consent Audit 1.0.0 checks browser-side requests and cookies, while Facebook Pixel 3.0.0-alpha1 adds Meta server-side conversion reporting with consent controls. Together, the releases show why Drupal teams need to test browser and backend measurement paths separately.

The International Splash Awards announced their 2026 winners during DrupalCon Rotterdam. Published results recognise winning Drupal projects across ten categories, followed by runners-up in each category. Organisers also reported a 40% increase in submissions compared with 2025.

Antonella Severo, Nikita Aswani and Rachel Lawson were named winners of the 2026 Women in Drupal Award at DrupalCon Rotterdam. This year's programme replaced the previous Define, Build and Scale categories with one award focused on overall contribution and impact. The recognition documents contributions by women across development, leadership, mentoring, advocacy, business and community work in the Drupal ecosystem.

Joomla has released 6.1.4 and 5.4.9 with fixes for 16 core security issues. The batch covers SSRF, arbitrary directory deletion, MFA bypass, access-control failures and cross-site scripting, while 5.4.9 introduces a regression affecting Web Services PATCH requests. For Drupal practitioners monitoring adjacent CMS ecosystems, the release shows why security patching still needs application and integration regression testing.

Pantheon has published new technical details about Americaneagle.com’s headless commerce rebuild for Dixon. The project uses Drupal 11, Next.js, Multidev review environments and automated performance checks, with parts of the deployment approach subsequently adopted across other agency Drupal projects. Dixon’s new storefront is targeted for launch in October 2026, so production performance results remain unavailable.

Acquia has turned its DrupalCon Rotterdam booth into a statement about how companies can contribute to Drupal. Shawn Perritt says the company deliberately reduced booth spending so it could donate $50,000 while continuing its existing contributions through code, maintainers, product work and staff time. The cardboard stand makes that funding decision the centre of Acquia's conference message.

The Drupal AI Initiative has named AI Inside Drupal Essentials, developed and delivered by DrupalEasy, as its official training program. Mike Anello leads the 18-hour course covering human-reviewed AI workflows, agents, retrieval-augmented generation and local models. The program gives Drupal practitioners structured training in applying AI while maintaining human review of generated output and exploring privacy-conscious local deployment.

Dries Buytaert used the DrupalCon Rotterdam DriesNote to launch a Drupal Advocacy Program and propose a Rosetta Sprint around shared descriptions of Drupal capabilities. The keynote also demonstrated multilingual Canvas workflows, JavaScript and headless development, a public AI demo, and agent access through MCP and Tool. Advocacy work can now earn contribution credit, while the proposed sprint would examine how Drupal capabilities could be exposed more consistently to agents, workflows, frontends, and other systems.

The Drupal Association says it is continuing to migrate essential services from the Oregon State University Open Source Lab to AWS as the lab restructures. AWS credits support infrastructure including autoscaling GitLab CI runners that handled about 4.1 million jobs and 159,800 compute hours over the year to 26 August 2026. The transition extends Drupal's existing AWS use and comes as the Association seeks a durable funding model for rising Drupal.org infrastructure costs.

Symfony is adding transactional outbox and claim check options to Messenger in the upcoming Symfony 8.2 release. One coordinates broker-bound messages with database transactions before forwarding them, while the other stores oversized messages separately and transports a verified reference. Drupal's Symfony Messenger integration supports Symfony 8, but available documentation does not establish support for these specific Symfony 8.2 options.

PHP released security updates for versions 8.2 through 8.5 that fix 11 named CVEs and an additional Filter issue. The flaws affect several runtime components, including HTTP streams, PHP-FPM, mysqlnd, Phar, SOAP and stream filters. Drupal operators need to match the releases against their PHP branch, configuration, hosting model and actual web and command-line runtimes.

The Drupal AI Initiative built a full-site demo to bring several AI workflows together in one working Drupal environment. Search, content review, translation and related tooling are tested against realistic content rather than shown only as separate capabilities. The approach gives prospective users a way to judge how those workflows behave when they meet the complexity of an actual site.

The DropTimes reviewed selected North American vacancies to see how employers working in or around government define senior Drupal roles. The postings combine Drupal development with accessibility, security, testing, delivery pipelines and systems integration, while individual roles also add component architecture, containers and AI-assisted development. The sample shows how Drupal responsibilities can broaden in complex delivery environments without establishing a wider hiring-market trend.

Gspikes measured 424 Drupal sites among 1,347 responding federal, state and territory .gov domains on 19 September 2026. The study reported a median server-time measure of 0.239 seconds and public signals for Drupal 7, 8 or 9 on 12 domains. Its results provide a dated snapshot of this registry segment, although the published subsidiary tables do not all reconcile and the performance testing used a single geographic location.

AI Automators Agent connects Drupal field automation with configured AI Agents instead of sending prompts directly to an AI provider. The beta allows field workflows to use an agent's tools, retrieval and multi-step execution across four supported text field types. Entity references are not yet supported, while structured agent output is currently stored as plain text.

Published Drupal core change records mark Search, Claro and Olivero for removal in Drupal 12.0.0. Contributed versions are available for sites that intend to continue using the three extensions after they leave core. Sites should account for those dependencies while preparing their Drupal 11-to-12 upgrade path.

amazee.io and amazee.ai are bringing AI governance, data sovereignty, and model access to DrupalCon Rotterdam 2026. Thomas Schröpfer and Tag1’s Hank VanZile will examine shadow AI, private gateway infrastructure, and Scolta as an implementation spanning Drupal, Laravel, and WordPress. For Drupal teams, the session focuses on the operational controls that become necessary when AI moves from experiments into maintained production systems.

Pantheon will demonstrate an outside-in Drupal workflow at DrupalCon Rotterdam 2026 on 29 September. Josh Koenig and Alejandro Moreno Lopez will show a purpose-built agent running on Google’s Gemini Enterprise Agent Platform and communicating with Drupal through its MCP Server interface and related tooling. The session tests a model in which selected work can begin outside Drupal while Drupal continues to define the site capabilities and permissions available to the agent.

Seven DrupalCon Rotterdam speaker groups examine production AI workflows, trusted answers, generative search, Drupal AI products, modern video delivery, HTMX, and open-source community sustainability across 28–30 September 2026. Their examples focus on observability, source quality, explicit tradeoffs, maintainable architecture, and ownership after an implementation begins working. For Drupal teams, the common question is how to recognise failure and unfinished work when the visible result already looks successful.

Speakers across eight DrupalCon Rotterdam session groups examine how structure makes migration, AI-assisted development, personalisation, enterprise editing, team health, and measurement more manageable. Their examples range from AI Content Migrate and an AI-assisted Drupal Canvas migration to an NHS careers platform covering more than 350 roles and clean-code practices for machine-generated code. For Drupal teams, the sessions show how content models, governance, tests, team practices, and meaningful metrics can keep faster systems understandable and maintainable.

DrupalCon Rotterdam speakers are examining how Workspaces, agentic AI, accessibility tools, and controlled answer systems divide work between automation and people. Ajit Shinde, Adam Nagy and David Galeano focus on governed changes and explicit approval, while Daniel Angelov, John Jameson, Christopher Torgalson, and Junaid Masoodi test the limits of automated accessibility. Antonella Picarella adds a public-sector AI case in which Drupal controls the content available to an assistance system and turns user questions into editorial feedback.

Josh Koenig describes Pantheon’s “outside-in” approach to Drupal AI ahead of a live demonstration at DrupalCon Rotterdam 2026. The demo connects a Drupal agent running through Gemini Enterprise with MCP Server capabilities intended to let external agents perform approved Drupal tasks. For Drupal teams, the approach shifts part of the AI discussion from embedding features inside the CMS towards exposing governed site-building and publishing capabilities to enterprise agent platforms.

Site Verification, Timezone Picker and Navigation Extra have published updates affecting major-version upgrades, timezone selection and Content menu administration. Site Verification 3.0.2 is now the current stable 3.x release after a fix for a Drupal 10-to-11 upgrade sequence, while Timezone Picker has reached its first stable release for Drupal 11 and Drupal 12. Navigation Extra 1.0.5 addresses an invalid menu entry that could interfere with Content menu administration.

Dropsolid says its Diamond sponsorship of DrupalCon Rotterdam 2026 reflects a wider investment in Drupal as an open foundation for governed artificial intelligence. Dominique De Cooman connects customer work on trusted answers and AI Search with Drupal's content structures, permissions, workflows and emerging AI governance capabilities. The company's Rotterdam programme places that argument beside product architecture, AI failure cases and lessons from the European Personnel Selection Office implementation.

The Enterprise AI Summit will bring business and digital leaders to the SS Rotterdam on 28 September 2026 for a day focused on enterprise uses of Drupal and artificial intelligence. Featured cases cover multilingual candidate support at EPSO, governed organisational context, the University of Waterloo admissions experience, World Cancer Day moderation, and AI used in American Diabetes Association editorial workflows. For Drupal teams, the sessions show how source grounding, institutional context, human review, sovereignty and existing platform architecture shape production AI.

NASCIO and Forrester have identified five recurring tensions shaping state technology modernisation. Georgia's GovHub and Australia's GovCMS show how shared Drupal platforms distribute common standards, platform investment, recurring costs, and agency control. For Drupal readers, the cases show that public-sector modernisation depends on governance and sustainable operating models as well as CMS architecture.

Recent Drupal core, contributed-project and ecosystem updates cover filename handling, recipe translation, workflow editing, template evaluation and hosting permissions. Drupal 12 filename hardening is committed but not yet packaged, Recipe Interface Translation Integration is in alpha, Workflow Modeler 1.0.9 is stable, and the simplytest.me and BOA capabilities are already available. Drupal teams need to respond according to the affected workflow and release state rather than treat the changes as a single update requirement.

DrupalCon Rotterdam will host two sessions on consecutive days about Drupal’s marketing story and its visibility in AI-generated answers. The marketing panel focuses on coordinated messaging, while Larissa Tropp’s BoF asks how documentation, case studies, discussions, and other community content may influence how AI tools represent Drupal. Together, the discussions connect established Drupal marketing work with questions about AI-assisted technology discovery.

The Drupal Security Team published 36 contributed-project security advisories on 23 September 2026, including 20 for Webform. Five advisories are rated Critical, led by an 18/25 Webform remote code execution issue whose exploitability depends on a specific form configuration. Site operators need to match installed project versions to the security releases and review the features, permissions and integrations that determine actual exposure.

Drupal 12 core development will require Node.js 24 when core's JavaScript development dependencies are installed. The change exposed Nightwatch test incompatibilities, and the resulting corrections were backported to Drupal 11.3 and 11.4 without raising their Node.js requirement. Raven 7.6 separately changes when Sentry initialises and adds performance tracing for console commands.

Zoocha CEO Will Huggins told The DropTimes why the agency sees supporting DrupalCon Rotterdam as part of its broader responsibility to give back to Drupal. Responsible AI, human oversight, investment in the Drupal AI Initiative, and stronger global marketing are among the priorities shaping its participation. His comments connect event sponsorship with broader questions about how Drupal organisations contribute, govern AI, and communicate the platform’s value.

Drupal AI, Commerce Stripe and LocalGov Microsites Domain Alias published releases on 16 September 2026. The updates address AI workflow defects, broader Stripe Payment Element support and predictable environment-specific aliases for microsites. Drupal teams can use the releases to resolve workflow problems, expand payment-method handling or make microsites reachable before their production domains are ready.

David Ortega Porras outlines the architecture behind a headless Drupal 11 platform for governing digital health assets in a public healthcare ecosystem. Drupal Commerce models assets and lifecycle states while identity, BPMN workflows, Kafka messaging, FHIR terminology and observability remain integrated specialist services. The approach shows how Drupal can provide the business model, APIs and governance layer while supporting digital sovereignty through open standards and explicit system boundaries.

The DropTimes held its September Open Townhall online on 22 September 2026 at 15:30 UTC. Discussion covered Drupal job discovery, advocacy themes, AI visibility, event coverage and ways for community members to participate in editorial planning. The meeting identified possible routes for contribution through reporting, distribution, topic selection and user-group programming.

Companies including GitHub, Google, IBM, Microsoft and Red Hat have signed an OpenSSF commitment supporting sustainable funding models for public package registries and participation as enterprise customers. Packagist is among the registries named, while the commitment supports continued free access for individual developers and small organisations and leaves pricing decisions to individual registries. Drupal projects are distributed through packages.drupal.org, while Drupal sites also depend on Composer and third-party PHP packages supplied through the wider registry ecosystem.

The Dev AI Summit at DrupalCon Rotterdam will run on 28 September 2026 with a programme for developers and technical practitioners. Sessions address AI-assisted contribution, workflow orchestration, governed context, guardrails, cost control and author review. For Drupal teams, the programme provides practical examples of the controls surrounding AI as it moves from experiments into production workflows.

Drupal core's current main branch still shows 15 of the 28 maintainer vacancies advertised in 2025 as unassigned. Twelve original vacancy areas received maintainers, although Settings Tray later left the current roster, while REST subsequently became a new vacancy. The comparison shows which 2025 openings were filled, remain unassigned, or disappeared as Drupal core changed.

DrupalCon Rotterdam sponsor Big Blue Door says shared public-sector platforms, practical AI use, and exchange with other practitioners are shaping its plans for the conference. Its responses connect those themes with LocalGov Drupal and the first live LocalNHS Drupal implementation at Bristol NHS Foundation Trust. For Drupal teams, the examples put reuse, governance, and cross-organisation collaboration at the centre of the public-sector platform discussion.

Stuart Clark has documented the Druxt 1.3.x release line, which replaces the Drupal module's hardcoded JSON:API resource list with administrator-controlled configuration. Version 1.3.0 preserves the existing resource set on upgrade, adds selectable configuration resources, and changes default CORS handling for browser preflight requests. Decoupled Drupal teams can expose settings such as editor configuration, image styles, and workflow information without maintaining a patch to Druxt's resource list.

Entity Adapter provides an interface-based way to attach domain-specific behaviour to Drupal objects without replacing their classes. Adapter implementations are discovered during service-container compilation, registered as autowired services, and requested through the interfaces they expose. The approach can reduce direct dependencies on field names and bundle implementations when the same domain behaviour is needed across several parts of an application.

FlowDrop 2.6.0 became the first stable release of the 2.x line on 22 September 2026. It adds AI-assisted workflow editing, multi-step assistant actions, retention reporting, configurable storage limits and runtime and database improvements. Sites upgrading need to run database updates and clear caches, while FlowDrop 1.x installations must pass through version 1.6.0 first.

The Drupal Security Team has scheduled security releases for a widely used contributed module on 23 September 2026 between 17:00 and 21:00 UTC. The highest-rated advisory is currently Critical at 16/25, while an updated PSA says other advisories may affect more common configurations and other contributed projects may also publish security releases that day. Drupal core is unaffected, and the announced releases will not be covered by Drupal Steward.

DrupalCamp Spain 2026 has extended its Call for Papers deadline to 27 September 2026. The event runs from 19 to 21 November at Talent Garden Madrid, with standard talks allotted 35 minutes and a maximum of 40 before a separate question period. Drupal practitioners considering a session can use the additional submission time to prepare proposals around the event’s published speaker guidance.

Compound Field 1.0.0-alpha1 lets Drupal 11.4 site builders combine existing field types into compound fields through Field UI. Sub-fields retain their own plugins, widgets, formatters and validation while their values are stored as columns in the host field table. The module remains an alpha release, and structural changes such as removing sub-fields or reducing cardinality can delete stored values.

Nick Schuch describes how Skpr is extending Compass to identify Drupal requests marked uncacheable by Dynamic Page Cache. The tracing view exposes timing, cache metadata and the component associated with a zero max-age or other poor-cacheability condition. The approach is intended to make performance problems easier to diagnose when they are otherwise hidden behind healthy edge-cache metrics.

Drupal 12.0.0-beta1 and Drupal 11.5.0-beta1 were not released during their scheduled September release week. Core contributors were still closing dependency, deprecation, testing, and release-note work as the window ended, and Drupal.org had not published a revised beta date by 21 September. Maintainers planning compatibility work therefore still have alpha1 as the latest Drupal 12 release while the November release-candidate and December stable milestones remain on the published schedule.